Overview

overview

10

Static

static

3

c26c2acac8...cs.exe

windows7-x64

3

c26c2acac8...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c26c2acac8badfe751f8614f4ff978a0_NeikiAnalytics.exe

  • Size

    1.6MB

  • Sample

    240518-pltwdsbe26

  • MD5

    c26c2acac8badfe751f8614f4ff978a0

  • SHA1

    e7bddc0bf4cd8b3fe801bb3fc4d75a0bddf52dda

  • SHA256

    190278e5db1ab39792859b7d7cbb4dfcf544bd4d6d52404bfc616b81e4e76196

  • SHA512

    6ea022497945444c85434895f21629d5620729d587cfe04dc74d4b62487468a0deffedfd791978582292f00b85e0622a81fdff9a7204de3a185a3d3f765389cb

  • SSDEEP

    49152:JTyfaerlkRH/7CG+xJZAOALfrSUv15gmm7kqQILp5ibWkg:JNewOALfrSUv15gmm7kqQILp5

Score
10/10
remcosremotehostpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

taker202.ddns.net:3017

taker202.duckdns.org:5033
Attributes
  • audio_folder

    MicRecords

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    xmnw-AAJ144

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Targets

    • Target

      c26c2acac8badfe751f8614f4ff978a0_NeikiAnalytics.exe

    • Size

      1.6MB

    • MD5

      c26c2acac8badfe751f8614f4ff978a0

    • SHA1

      e7bddc0bf4cd8b3fe801bb3fc4d75a0bddf52dda

    • SHA256

      190278e5db1ab39792859b7d7cbb4dfcf544bd4d6d52404bfc616b81e4e76196

    • SHA512

      6ea022497945444c85434895f21629d5620729d587cfe04dc74d4b62487468a0deffedfd791978582292f00b85e0622a81fdff9a7204de3a185a3d3f765389cb

    • SSDEEP

      49152:JTyfaerlkRH/7CG+xJZAOALfrSUv15gmm7kqQILp5ibWkg:JNewOALfrSUv15gmm7kqQILp5

    Score
    10/10
    remcosremotehostpersistencerat

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks